[Feb-2024] Get 100% Real CPSA_P_New Exam Questions, Accurate & Verified TrainingQuiz Dumps in the Real Exam! [Q22-Q45]

NEW QUESTION 22
A vendor discovers that a recent shipment of cards is missing a set. Which of the following responses would you expect in a compliant organization?

An immediate call is made to the issuer and the VPA who, between them, contact law enforcement and put together a joint statement

The head of security initiates a meeting, and once the VPA approves the messaging, law enforcement is notified in two days

A report is requested by the issuer, the vendor sends it to them, and the issuer handles the incident with the local police

After an incident review, the VPA, issuer and law enforcement are all notified within 24 hours

NEW QUESTION 23
The vendor’s technical documentation shows that the alarm system does not send alerts to the security control room. After a discussion you learn that the alarm works perfectly, and sends a clear signal to summon the local police every time an emergency exit is opened. Why might this cause a problem for their assessment?

If the local police have not been issued with an exterior key. they will not be able to investigate the cause of the alarm and reset it

During working hours, the alarm should be managed in the security control room, or by a central monitoring service

If the local police receive too many false-positive alerts, they may not respond within 15 minutes of the alarm

During busy times, the local police may not be able to respond

NEW QUESTION 24
Which of these is a requirement of the security control room?

Access must be controlled by a physical key (in case of power-failure)

Access must be monitored in real-time

At least one guard must be present at all times

Dual-control must be used to grant entry

NEW QUESTION 25
After reviewing their completed ROC and AOC, which state that they are compliant, the vendor wishes to be listed on PCI SSC’s list of Compliant Card Vendors. How should you assist them with the listing process?

Submit the full ROC to PCI SSC

Submit only the AOC to PCI SSC

Inform the vendor that PCI SSC does not list compliant vendors

Inform the vendor that they must request a listing via the payment brand(s) that received their ROC

NEW QUESTION 26
A vendor wants to know if they will be penalized if their vault is not compliant. Who should they ask?

PCI SSC

Assessor

Issuing banks

Payment brands

NEW QUESTION 27
Which of these are guards allowed access to?

HSAs

Audit logs

Loading bays

Physical master keys that provide access to card production or provisioning areas

NEW QUESTION 28
To liberate a person detected inside of the inner shipping delivery room and stop the alarm, the software monitoring the access-control system must only allow the opening of which door?

The external facing door

The internal facing door

The last activated door

The least secure door

NEW QUESTION 29
During an assessment you ask to see employee records for employees with access to the HSA. The records include information about the screening process, including background information from the employee application process. The oldest background Information that is available is for an employee that left the vendor (terminated their contract) one year previously. You note this as non-compliant, why?

Employee information, including background checks, must be stored for at least seven years

Employee information must be securely destroyed (e.g. securely wiped) within 2 years (after termination of contract)

The vendor must retain the background information for at least 18 months after termination of contract

The vendor must only retain background information for all current employees, not for those that have been terminated

NEW QUESTION 30
A vendor uses codes from a chip manufacturer to ‘unlock’ chips and prepare them for use by adding applications and keys. Which of the following best describes this process?

Data creation

Data preparation

Manufacture

Pre-personalization

NEW QUESTION 31
In which of the following locations must the CCTV and access control servers be located?

Within the Security Control Room (SCR)

Within a room in the HSA with security controls equivalent to the SCR applied

Within the SCR or a room with equivalent security

Within the secure server room inside of the HSA

NEW QUESTION 32
You are driving to a vendor for their first assessment. The facility is in a rural area, twenty miles away from the nearest large town. What most concerns you about the location?

The local fire service may not be able to reach the facility within 15 minutes

Law enforcement services may not be able to reach the facility in a timely manner

Power blackouts may affect security systems

There may not be adequate retail outlets, which may cause problems when sourcing lunch items for onsite personnel

NEW QUESTION 33
An assessor is unsure if log review and interview is sufficient testing for a requirement. Who can best answer this question?

Payment brands

Issuing banks

Vendor

PCI SSC

NEW QUESTION 34
Which of the following statements is true in relation to visitor access badges?

Each visitor entering the facility must be issued and must visibly wear a disposable ID badge that identifies them as a non-employee

Each visitor entering the facility must wear their issued access badge above waist height

Badges with access-controls must not be issued to visitors

Unissued visitor access badges must be securely stored

NEW QUESTION 35
A vendor has a list of pre-approved third parties which may be granted access to the facility. Under what circumstances can other third-parties be granted access?

None, only people on the pre-approved list may enter

When they are approved by the physical security manager or senior management

When the third party s liability insurance covers the risk

When no card production activities are taking place

NEW QUESTION 36
For how long must a vendor retain all applicant and employee background information on file?

For at least 12 months after termination of the contract of employment

For at least 18 months after termination of the contract of employment

For at least 24 months after termination of the contract of employment

It is not a requirement to store this information beyond termination of the contract

NEW QUESTION 37
During an assessment you do a walk-through of bringing card products into the HSA using the goods-tools trap. You act as production staff, using an empty cardboard box as the card products. During the process, the guard escorts you, along with the box, into the pre-press room. What is your conclusion?

Compliant, because the guard escorted you

Compliant, because the guard ensured that the card product remained under dual control

Not compliant, because an inventory of the card product did not take place prior to entry

Not compliant, because the guard escorted you

Explanation
According to the PCI Card Production Physical Security Requirements, the goods-tools trap is a secure area that separates the HSA from the outside world, and is used to control the entry and exit of card products, tools, and other materials. The goods-tools trap must have two doors that are interlocked, meaning that only one door can be opened at a time. The goods-tools trap must also have a CCTV camera and an alarm system. The process of bringing card products into the HSA using the goods-tools trap must follow these steps1:
The card products must be delivered to the goods-tools trap by authorized personnel, who must present their identification to the guard and sign a delivery note.
The guard must verify the identification of the personnel and the quantity and quality of the card products, and record the details in a log.
The guard must then escort the personnel to the first door of the goods-tools trap, and open it using a key or a card reader. The personnel must place the card products inside the goods-tools trap and exit the area. The guard must then lock the first door.
The guard must then notify the production staff inside the HSA that the card products are ready to be collected. The production staff must present their identification to the guard and sign a receipt note.
The guard must then escort the production staff to the second door of the goods-tools trap, and open it using a key or a card reader. The production staff must collect the card products from the goods-tools trap and enter the HSA. The guard must then lock the second door.
In this scenario, the guard escorted the production staff, along with the box, into the pre-press room. This is not compliant, because the guard is not authorized to enter the HSA, and the card products must remain under dual control at all times. The guard should have stayed outside the HSA and only opened the second door of the goods-tools trap for the production staff. This would ensure that the card products are securely transferred from the goods-tools trap to the HSA, and that the guard does not compromise the security of the HSA.
References:
PCI Card Production Physical Security Requirements, v2.0, April 2019, page 15, requirement 2.1.1 PCI Card Production Physical Security Requirements, v2.0, April 2019, page 16, requirement 2.1.2 PCI Card Production Physical Security Requirements, v2.0, April 2019, page 17, requirement 2.1.3 PCI Card Production Physical Security Requirements, v2.0, April 2019, page 18, requirement 2.1.4

NEW QUESTION 38
A vendor’s HSA access is enforced by a security turnstile they have a logical access-control system that ensures anti pass-back. The device is functioning correctly. When must the status of the access change?

Only when an unauthorised badge is presented

Only when the person has successfully completed the access cycle

Upon initial entry of the person into the device, prior to completion of the access cycle

Upon initial presentation of an authorised badge, prior to completion of the access cycle

NEW QUESTION 39
For each requirement listed in a ROC, which types of findings must have a full narrative response?

All types of findings

Non-compliant findings only

New or Closed findings only

All types except Not Applicable findings

Explanation
According to the PCI Card Production and Provisioning Template for Report on Compliance, for each requirement listed in a ROC, all types of findings must have a full narrative response. A finding is the result of the assessor’s evaluation of the entity’s compliance status for each requirement. The types of findings are:
Compliant: The entity meets the requirement as stated in the PCI Card Production Standards.
Non-Compliant: The entity does not meet the requirement as stated in the PCI Card Production Standards.
Not Applicable: The requirement does not apply to the entity’s environment or operations.
Not Tested: The requirement was not tested by the assessor for a valid reason.
New: The entity has implemented a new process, system, or control that affects the requirement since the last assessment.
Closed: The entity has remediated a previous non-compliant finding and has provided sufficient evidence to the assessor.
A full narrative response is a detailed explanation of the finding, including the following elements:
The scope of testing performed by the assessor to evaluate the requirement The testing procedures and tools used by the assessor The sampling methodology and rationale used by the assessor The evidence collected and reviewed by the assessor The observations and conclusions made by the assessor The recommendations and remediation actions (if any) suggested by the assessor A full narrative response is required for all types of findings to provide a clear and comprehensive documentation of the entity’s compliance status and to support the assessor’s professional judgment and opinion. A full narrative response also helps the payment brands, the PCI SSC, and the entity itself to understand the entity’s environment, risks, and controls, and to verify the accuracy and validity of the assessment. References:
PCI Card Production and Provisioning Template for Report on Compliance, Version 1.0, April 2019, page 4 PCI Card Production and Provisioning Template for Report on Compliance, Version 1.0, April 2019, page 5 PCI Card Production and Provisioning Template for Report on Compliance, Version 1.0, April 2019, page 6

NEW QUESTION 40
A vendor is unsure which forms are needed to complete an assessment. Who should they ask?

Payment brands

Issuing banks

PCI SSC

Assessor

NEW QUESTION 41
Which of the following principles must be enforce by the HSA Access Control system?

Dual control

Dual presence

Dual control and dual presence

Dual guard entry when required

NEW QUESTION 42
Which of the follow best describes a Technical FAQ?

Technical FAQs only apply to the specific technology as the FAQ defines it

Technical FAQs can be submitted to PCI SSC at any time

Use of the Technical FAQs is mandatory, they shall be used during an assessment

Use of the Technical FAQs is optional, they are considered guidance

Quiz Training Materials

[Feb-2024] Get 100% Real CPSA_P_New Exam Questions, Accurate & Verified TrainingQuiz Dumps in the Real Exam! [Q22-Q45]

2024 Updated PCI CPSA Certification Study Guide Pass CPSA Fast [Q30-Q44]

Leave a Reply Cancel reply

Quiz Training Materials

[Feb-2024] Get 100% Real CPSA_P_New Exam Questions, Accurate & Verified TrainingQuiz Dumps in the Real Exam! [Q22-Q45]

You May Also Like...

2024 Updated PCI CPSA Certification Study Guide Pass CPSA Fast [Q30-Q44]

Leave a Reply Cancel reply